Underground, Suelette Dreyfus [ebook reader online .txt] 📗

wanted people posting to Zardoz to provide detailed, step-by-step explanations on how to exploit a particular security hole. Hackers would always find out about bugs one way or another and the best way to keep them out of your system was to secure it properly in the first place. They wanted full disclosure.

In the other corner, the hard-line, command-and-control computer security types argued that posting an announcement to Zardoz posed the gravest of security risks. What if Zardoz fell into the wrong hands? Why, any sixteen-year-old hacker would have step-by-step directions showing how to break into thousands of individual computers! If you had to reveal a security flaw—and the jury was still out in their minds as to whether that was such a good idea—it should be done only in the most oblique terms.

What the hard-liners failed to understand was that world-class hackers like Electron could read the most oblique, carefully crafted Zardoz postings and, within a matter of days if not hours, work out exactly how to exploit the security hole hinted at in the text. After which they could just as easily have written a cookbook version of the security bug.

Most good hackers had come across one or two issues of Zardoz in their travels, often while rummaging though the system administrator’s mail on a prestigious institution’s computer. But no-one from the elite of the Altos underground had a full archive of all the back issues. The hacker who possessed that would have details of every major security hole discovered by the world’s best computer security minds since at least 1988.

Like Zardoz, Deszip was well guarded. It was written by computer security expert Dr Matthew Bishop, who worked at NASA’s Research Institute for Advanced Computer Science before taking up a teaching position at Dartmouth, an Ivy League college in New Hampshire. The United States government deemed Deszip’s very fast encryption algorithms to be so important, they were classified as armaments. It was illegal to export them from the US.

Of course, few hackers in 1990 had the sophistication to use weapons such as Zardoz and Deszip properly. Indeed, few even knew they existed. But Electron and Phoenix knew, along with a tiny handful of others, including Pad and Gandalf from Britain. Congregating on Altos in Germany, they worked with a select group of others carefully targeting sites likely to contain parts of their holy grail. They were methodical and highly strategic, piecing information together with exquisite, almost forensic, skill. While the common rabble of other hackers were thumping their heads against walls in brute-force attacks on random machines, these hackers spent their time hunting for strategic pressure points—the Achilles’ heels of the computer security community.

They had developed an informal hit list of machines, most of which belonged to high-level computer security gurus. Finding one or two early issues of Zardoz, Electron had combed through their postings looking not just on the surface—for the security bugs—but also paying careful attention to the names and addresses of the people writing articles. Authors who appeared frequently in Zardoz, or had something intelligent to say, went on the hit list. It was those people who were most likely to keep copies of Deszip or an archive of Zardoz on their machines.

Electron had searched across the world for information about Deszip and DES (Data Encryption Standard), the original encryption program later used in Deszip. He hunted through computers at the University of New York, the US Naval Research Laboratories in Washington DC, Helsinki University of Technology, Rutgers University in New Jersey, Melbourne University and Tampere University in Finland, but the search bore little fruit. He found a copy of CDES, a public domain encryption program which used the DES algorithm, but not Deszip. CDES could be used to encrypt files but not to crack passwords.

The two Australian hackers had, however, enjoyed a small taste of Deszip. In 1989 they had broken into a computer at Dartmouth College called Bear. They discovered Deszip carefully tucked away in a corner of Bear and had spirited a copy of the program away to a safer machine at another institution.

It turned out to be a hollow victory. That copy of Deszip had been encrypted with Crypt, a program based on the German Enigma machine used in World War II. Without the passphrase—the key to unlock the encryption—it was impossible to read Deszip. All they could do was stare, frustrated, at the file name Deszip labelling a treasure just out of reach.

Undaunted, the hackers decided to keep the encrypted file just in case they ever came across the passphrase somewhere—in an email letter, for example—in one of the dozens of new computers they now hacked regularly. Relabelling the encrypted Deszip file with a more innocuous name, they stored the copy in a dark corner of another machine. Thinking it wise to buy a little insurance as well, they gave a second copy of the encrypted Deszip to Gandalf, who stored it on a machine in the UK in case the Australians’ copy disappeared unexpectedly.

In January 1990, Electron turned his attention to getting Zardoz. After carefully reviewing an old copy of Zardoz, he had discovered a system admin in Melbourne on the list. The subscriber could well have the entire Zardoz archive on his machine, and that machine was so close—less than half an hour’s drive from Electron’s home. All Electron had to do was to break into the CSIRO.

The Commonwealth Scientific and Industrial Research Organisation, or CSIRO, is a government owned and operated research body with many offices around Australia. Electron only wanted to get into one: the Division of Information Technology at 55 Barry Street, Carlton, just around the corner from the University of Melbourne.

Rummaging through a Melbourne University computer, Electron had already found one copy of the Zardoz archive, belonging to a system admin. He gathered it up and quietly began downloading it to his computer, but as his machine slowly siphoned off the Zardoz copy, his link to the university abruptly went dead. The admin had discovered the hacker and quickly killed the connection. All of which left Electron back at square one—until he found another copy of Zardoz on the CSIRO machine.

It was nearly 3 a.m. on 1 February 1990, but Electron wasn’t tired. His head was buzzing. He had just successfully penetrated an account called Worsley on the CSIRO computer called DITMELA, using the sendmail bug. Electron assumed DITMELA stood for Division of Information Technology, Melbourne, computer `A’.

Electron began sifting through Andrew Worsley’s directories that day. He knew Zardoz was in there somewhere, since he had seen it before. After probing the computer, experimenting with different security holes hoping one would let him inside, Electron managed to slip in unnoticed. It was mid-afternoon, a bad time to hack a computer since someone at work would likely spot the intruder before long. So Electron told himself this was just a reconnaissance mission. Find out if Zardoz was on the machine, then get out of there fast and come back later—preferably in the middle of the night—to pull Zardoz out.

When he found a complete collection of Zardoz in Worsley’s directory, Electron was tempted to try a grab and run. The problem was that, with his slow modem, he couldn’t run very quickly. Downloading Zardoz would take several hours. Quashing his overwhelming desire to reach out and grab Zardoz then and there, he slipped out of the machine noiselessly.

Early next morning, an excited and impatient Electron crept back into DITMELA and headed straight for Worsley’s directory. Zardoz was still there. And a sweet irony. Electron was using a security bug he had found on an early issue of Zardoz to break into the computer which would surrender the entire archive to him.

Getting Zardoz out of the CSIRO machine was going to be a little difficult. It was a big archive and at 300 baud—30 characters per second—Electron’s modem would take five hours to siphon off an entire copy. Using the CAT command, Electron made copies of all the Zardoz issues and bundled them up into one 500 k file. He called the new file .t and stored it in the temporary directory on DITMELA.

Then he considered what to do next. He would mail the Zardoz bundle to another account outside the CSIRO computer, for safe-keeping. But after that he had to make a choice: try to download the thing himself or hang up, call Phoenix and ask him to download it.

Using his 2400 baud modem, Phoenix would be able to download the Zardoz bundle eight times faster than Electron could. On the other hand, Electron didn’t particularly want to give Phoenix access to the CSIRO machine. They had both been targeting the machine, but he hadn’t told Phoenix that he had actually managed to get in. It wasn’t that he planned on withholding Zardoz when he got it. Quite the contrary, Electron wanted Phoenix to read the security file so they could bounce ideas off each other. When it came to accounts, however, Phoenix had a way of messing things up. He talked too much. He was simply not discreet.

While Electron considered his decision, his fingers kept working at the keyboard. He typed quickly, mailing copies of the Zardoz bundle to two hacked student accounts at Melbourne University. With the passwords to both accounts, he could get in whenever he wanted and he wasn’t taking any chances with this precious cargo. Two accounts were safer than one—a main account and a back-up in case someone changed the password on the first one.

Then, as the DITMELA machine was still in the process of mailing the Zardoz bundle off to the back-up sites, Electron’s connection suddenly died.

The CSIRO machine had hung up on him, which probably meant one thing. The admin had logged him off. Electron was furious. What the hell was a system administrator doing on a computer at this hour? The admin was supposed to be asleep! That’s why Electron logged on when he did. He had seen Zardoz on the CSIRO machine the day before but he had been so patient refusing to touch it because the risk of discovery was too great. And now this.

The only hope was to call Phoenix and get him to login to the Melbourne Uni accounts to see if the mail had arrived safely. If so, he could download it with his faster modem before the CSIRO admin had time to warn the Melbourne Uni admin, who would change the passwords.

Electron got on the phone to Phoenix. They had long since stopped caring about what time of day they rang each other. 10 p.m. 2 a.m. 4.15 a.m. 6.45 a.m.

`Yeah.’ Electron greeted Phoenix in the usual way.

`Yup,’ Phoenix responded.

Electron told Phoenix what happened and gave him the two accounts at Melbourne University where he had mailed the Zardoz bundle.

Phoenix hung up and rang back a few minutes later. Both accounts were dead. Someone from Melbourne University had gone in and changed the passwords within 30 minutes of Electron being booted off the CSIRO computer. Both hackers were disturbed by the implications of this event. It meant someone—in fact probably several people—were onto them. But their desperation to get Zardoz overcame their fear.

Electron had one more account on the CSIRO computer. He didn’t want to give it to Phoenix, but he didn’t have a choice. Still, the whole venture was filled with uncertainty. Who knew if the Zardoz bundle was still there? Surely an admin who bothered to kick Electron out would move Zardoz to somewhere inaccessible. There was, however, a single chance.

When Electron read off the password and username, he told Phoenix to copy the Zardoz bundle to a few other machines on the Internet instead of trying to download it to his own computer. It would be much quicker, and the CSIRO admin wouldn’t dare break into someone